Google said it wants to help ease the pain of properly securing email, which has traditionally been done using the Pretty Good Privacy (PGP) protocol. Whilst PGP works effectively at keeping prying eyes out, it’s not as simple as using standard email services, as it involves effective key management.

Google being good

“Today we’re making available the source code for End-to-End, a Chrome extension. It’s currently in testing, and once it’s ready for general use it will make this technology easier for those who choose to use it,” said Brandon Long, tech lead for the Gmail Delivery Team, in a blog post.

Google believes 40 to 50 percent of emails sent between Gmail and other email providers aren’t encrypted.

Gmail has traditionally used the Transport Layer Security (TLS) protocol to protect emails in transit. Long noted the “important thing is that both sides of an email exchange need to support encryption for it to work; Gmail can’t do it alone”.

More problems with web encryption

TLS itself has been proven vulnerable in the past, however. One version, known as GnuTLS, was shown to be flawed this week, although that does not affect Gmail. A patch has been released, but anyone who hasn’t downloaded it and is using GnuTLS will still be open to nasty attacks.

The problem lay in how GnuTLS handled session identifiers of user connections. It meant that a malicious server could use the flaw “to send an excessively long session id value and trigger a buffer overflow in a connecting TLS/SSL client using GnuTLS”, an advisory from open source vendor Red Hat read. Buffer overflow can be used to write code, such as malware, to a connecting machine.

The problem affected various versions of the Linux operating system, including Red Hat Enterprise 5 and 6.

In April, the Heartbleed bug emerged, showing up a serious problem in the OpenSSL form of web encryption. Google researchers helped uncover that vulnerability, which could have leaked cryptographic keys and opened up web servers to criminal surveillance.